Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

86,991cataloged exploits
40,452CVEs with public exploitation
24,696lab-tested
AllReferência 26,240Exploit-DB 24,488GitHub PoC 18,044VulnCheck XDB 10,121Nuclei 4,561Metasploit 3,537✓ verified onlyrecentpopularrisk
26,240 exploits
Referência
CVE-2026-85022
CVE-2026-85022MEDIUM
langgenius dify WebApp Sign-In mail-and-password-auth.tsx router.replace cross site scripting
33RISK
open ↗
Referência
CVE-2026-110107
CVE-2026-110107LOW
RuoYi-Cloud-Plus through 6.0.0 IDOR via DELETE /auth/unlock/{socialId}
28RISK
open ↗
Referência
CVE-2026-8211
CVE-2026-8211MEDIUM
codelibs Fess JSP File AdminDesignAction.java update code injection
33RISK
open ↗
Referência
CVE-2016-7200
CVE-2016-7200HIGHunder attack
The Chakra JavaScript scripting engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a de
93RISK
open ↗
Referência
CVE-2017-12579
CVE-2017-12579—
An insecure suid wrapper binary in the HashiCorp Vagrant VMware Fusion plugin (aka vagrant-vmware-fusion) 4.0.24 and ear
23RISK
open ↗
Referência
CVE-2014-5088
CVE-2014-5088—
Cross-site scripting (XSS) vulnerability in Status2k allows remote attackers to inject arbitrary web script or HTML via
23RISK
open ↗
Referência
CVE-2014-9456
CVE-2014-9456—
Buffer overflow in NotePad++ 6.6.9 allows remote attackers to have unspecified impact via a long Time attribute in an Ev
28RISK
open ↗
Referência
CVE-2016-6603
CVE-2016-6603—
ZOHO WebNMS Framework 5.2 and 5.2 SP1 allows remote attackers to bypass authentication and impersonate arbitrary users v
45RISK
open ↗
Referência
CVE-2026-9468
CVE-2026-9468MEDIUM
dazeb cline-mcp-memory-bank index.ts handleInitializeMemoryBank path traversal
33RISK
open ↗
Referência✓ VexDay Proof
PHP AMX 0.90 - '/plugins/main.php' Remote File Inclusion
CVE-2006-5427—webappsphp
PHP remote file inclusion vulnerability in plugins/main.php in Php AMX 0.9.0, when register_globals is enabled or magic_
23RISK
open ↗
Referência
CVE-2011-4825
CVE-2011-4825—
Static code injection vulnerability in inc/function.base.php in Ajax File and Image Manager before 1.1, as used in tinym
50RISK
open ↗
Referência
CVE-2026-41949
CVE-2026-41949HIGH
Dify < 1.14.2 Authorization Bypass via File Preview Endpoint
41RISK
open ↗
Referência
CVE-2019-15977
CVE-2019-15977CRITICAL
Cisco Data Center Network Manager Authentication Bypass Vulnerabilities
60RISK
open ↗
Referência
CVE-2026-85021
CVE-2026-85021MEDIUM
langgenius dify Splash Layout splash.tsx router.replace cross site scripting
33RISK
open ↗
Referência✓ VexDay Proof
Softerra PHP Developer Library 1.5.3 - Remote File Inclusion
CVE-2006-5472—webappsphp
PHP remote file inclusion vulnerability in Softerra PHP Developer Library 1.5.3 and earlier allows remote attackers to e
23RISK
open ↗
Referência
CVE-2026-108676
CVE-2026-108676MEDIUM
JeecgBoot through 3.9.5 Missing Authorization via /sys/annountCement/downLoadFiles
33RISK
open ↗
Referência
CVE-2026-79621
CVE-2026-79621MEDIUM
CatalogX < 6.1.3 - Unauthenticated Email Content Injection via Shared Transient
33RISK
open ↗
Referência
CVE-2026-77783
CVE-2026-77783LOW
Rank Math SEO < 1.0.277 - Unauthenticated Non-Public Post Schema and Content Disclosure
28RISK
open ↗
Referência✓ VexDay Proof
DigitalHive 2.0 RC2 - 'base_include.php' Remote File Inclusion
CVE-2006-5493—webappsphp
PHP remote file inclusion vulnerability in template/purpletech/base_include.php in DigitalHive 2.0 RC2 allows remote att
23RISK
open ↗
Referência✓ VexDay Proof
pandaBB - 'displayCategory' Remote File Inclusion
CVE-2006-5494—webappsphp
Multiple PHP remote file inclusion vulnerabilities in modules/My_eGallery/public/displayCategory.php in the pandaBB modu
23RISK
open ↗
Referência
CVE-2014-5284
CVE-2014-5284—
host-deny.sh in OSSEC before 2.8.1 writes to temporary files with predictable filenames without verifying ownership, whi
23RISK
open ↗
Referência
CVE-2014-5287
CVE-2014-5287—
A Bash script injection vulnerability exists in Kemp Load Master 7.1-16 and earlier due to a failure to sanitize input i
23RISK
open ↗
Referência
CVE-2019-1652
CVE-2019-1652HIGHunder attack
Cisco Small Business RV320 and RV325 Routers Command Injection Vulnerability
100RISK
open ↗
Referência
CVE-2019-1652
CVE-2019-1652HIGHunder attack
Cisco Small Business RV320 and RV325 Routers Command Injection Vulnerability
100RISK
open ↗
Referência
CVE-2026-9366
CVE-2026-9366MEDIUM
NousResearch hermes-agent prompt_builder.py _scan_context_content injection
33RISK
open ↗
Referência
CVE-2017-12617
CVE-2017-12617HIGHunder attack
When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTT
100RISK
open ↗
Referência✓ VexDay Proof
DataTrac Activity Console - Denial of Service
CVE-2005-1667—doswindows
DataTrac Activity Console 1.1 allows remote attackers to cause a denial of service via a long HTTP GET request.
23RISK
open ↗
Referência✓ VexDay Proof
PHPMyRing 4.2.1 - 'cherche.php' SQL Injection
CVE-2006-5638—webappsphp
Multiple SQL injection vulnerabilities in cherche.php in PHPMyRing 4.2.1 and earlier allow remote attackers to execute a
23RISK
open ↗
Referência
CVE-2011-5044
CVE-2011-5044—
SopCast 3.4.7.45585 uses weak permissions (Everyone:Full Control) for Diagnose.exe, which allows local users to execute
23RISK
open ↗
Referência
CVE-2014-8739
CVE-2014-8739—
Unrestricted file upload vulnerability in server/php/UploadHandler.php in the jQuery File Upload Plugin 6.4.4 for jQuery
60RISK
open ↗
← previouspage 283 / 875next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.